Composer backpack/crud has 11 known advisories in the phpwarden feed. Feed 2026.10.29.4, updated 2026-10-29.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2018-20962 | Backpack\CRUD for Laravel XSS Vulnerability | medium | 6.1 | <3.4.9 | 3.4.9 |
| CVE-2026-54177 | Laravel Backpack CRUD: HasUploadFields keeps the attacker-supplied file extension — public-disk uploads of `shell.php` reach the webserver | medium | 6.6 | >=6.0.0 and <6.8.14 or >=7.0.0 and <7.0.38 | 6.8.14, 7.0.38 |
| CVE-2026-54182 | Laravel Backpack CRUD: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth) | high | 8.1 | >=4.1.0 and <4.1.72 or >=5.0.0 and <5.6.2 or >=6.0.0 and <6.8.13 or >=7.0.0 and <7.0.36 | 4.1.72, 5.6.2, 6.8.13, 7.0.36 |
| CVE-2026-54176 | Laravel Backpack CRUD: MyAccountController allows changing the login email without a current-password check | medium | 6.5 | >=6.0.0 and <6.8.14 or >=7.0.0 and <7.0.38 | 6.8.14, 7.0.38 |
| CVE-2026-54178 | Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk | high | 8.1 | >=5.0.0 or >=6.0.0 and <6.8.12 or >=7.0.0 and <7.0.35 | – |
| CVE-2026-54175 | Laravel Backpack CRUD: Unverified password change in MyAccountController via mass assignment | high | 7.6 | <6.8.11 or >=7.0.0-alpha.1 and <7.0.34 | 6.8.11, 7.0.34 |
| CVE-2026-54180 | Laravel Backpack CRUD: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR) | high | 7.6 | >=6.0.0 and <6.8.14 or >=7.0.0 and <7.0.38 | 6.8.14, 7.0.38 |
| CVE-2026-57570 | Laravel Backpack CRUD: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation | medium | 6.5 | >=7.0.0 and <7.0.47 or >=6.0.0 and <6.8.15 | 7.0.47, 6.8.15 |
| CVE-2026-54181 | Laravel Backpack CRUD: Stored XSS in the color column — the `@if($column['escaped'])` branches are inverted | medium | 5.4 | >=6.0.0 and <6.8.14 or >=7.0.0 and <7.0.38 | 6.8.14, 7.0.38 |
| CVE-2022-31114 | backpack/crud is vulnerable to Cross-Site Scripting (XSS) | medium | 0.0 | >=5.0.0 and <5.0.13 or >=4.1.0 and <4.1.69 or <4.0.63 | 5.0.13, 4.1.69, 4.0.63 |
| CVE-2026-54179 | Laravel Backpack CRUD: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk | medium | 4.4 | >=6.0.0 and <6.8.14 or >=7.0.0 and <7.0.38 | 6.8.14, 7.0.38 |
Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# PHP projects (recommended) composer require --dev phpwarden/phpwarden # then vendor/bin/phpwarden deps composer.lock # or, without Composer pipx install phpwarden && phpwarden deps composer.lock
Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command
Install docs How findings are ranked